#1
Member
Profile: Join Date: Apr 2010
Location: Lincoln, UK
Posts: 8
Computer Experience:
[Inactive] Can not open programmes
HiCPU T8300 @ 2.40GHz | Microprocessor | 2401/200mhzSP1 (KB953595)SP1 (KB958484)Ad AssistantSP1 SP2 )SP2 )SP2 (KB936181)SP2 (KB941833)SP2 (KB954430)SP2 (KB973688)SP1 (KB963707)HJT Report ===============js : browser.startup.homepage - hxxp://www3.iamwired.net/js : browser.search.selectedEngine - Searchjs : keyword.URL - hxxp://www3.iamwired.net/websearch.php?src=tops&search=js : keyword.enabled - truejs : browser.search.defaulturl - hxxp://www3.iamwired.net/websearch.php?src=tops&search=Ad Assistant: No Registry Reference - c:\program files\mozilla firefox\extensions\{7cc47780-d855-b1e3-85e7-a5eac2594ef3}js : google.toolbar.linkdoctor.enabled - falsehttp .sys
Didn't find the information you thought to find?Similar Threads
#2
Malware Analyst
Profile: Join Date: Aug 2002
Location: Daly City, CA
Posts: 10,012
Computer Experience:
Please download and run the below tool named Rkill (courtesy of BleepingComputer.com ) which may help allow other programs to run.Run as Administrator Rkill.com Rkill.scr Rkill.pif Rkill.exe If using Vista or Windows 7 right-click on it and choose Run As Administrator black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.Link 2 .immediately run the following.exeHelper. exeHelper from Raktor exeHelper.com to run the fix.log.txt file to your next message.[/LIST]Note: "Error deleting file ", please re-run the program before posting a log - and post the two logs together (they will both be in the one file).Here Here **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop** Please, never rename Combofix unless instructed.
Close any open browsers.
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.Very Important! disable your anti-virus , script blocking and any anti-malware real-time protection before "unpredictable results" .Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask. NOTE1. Recovery Console NOTE 2. always do so .Close any open browsers.
WARNING: Combofix will disconnect your machine from the Internet as soon as it startsPlease do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.
**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall** Make sure, you re-enable your security programs, when you're done with Combofix. DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
#3
Member
Profile: Join Date: Apr 2010
Location: Lincoln, UK
Posts: 8
Computer Experience:
Thankshttp .sysjs : browser.startup.homepage - hxxp://www3.iamwired.net/js : keyword.URL - hxxp://www3.iamwired.net/websearch.php?src=tops&search=js : keyword.enabled - truejs : browser.search.defaulturl - hxxp://www3.iamwired.net/websearch.php?src=tops&search=http://www.gmer.net SP1 (WinNT 6.00.1905)http://www.google.co.uk/ig/dell?hl=e...uk&ibd=2080712 http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://www.intercasino.co.uk/ (file missing) (HKCU)http://www.intercasino.co.uk/ (file missing) (HKCU)http://upload.facebook.com/controls/...oUploader5.cab https://support.dell.com/systemprofiler/SysProExe.CAB http://gfx1.hotmail.com/mail/w3/pr01...PUplden-gb.cab http://upload.facebook.com/controls/...Uploader55.cab http://gfx1.hotmail.com/mail/w4/pr01...PUplden-gb.cab https://plugins.valueactive.eu/flashax/iefax.cab
#4
Malware Analyst
Profile: Join Date: Aug 2002
Location: Daly City, CA
Posts: 10,012
Computer Experience:
You're not running any antivirus program.open Notepad Click Start , then Run
Type notepad .exe in the Run Box.
copy/paste the entire content of the codebox below into the Notepad window:
Code:
File::
c:\windows\system32\uk--zdjh_KAXA25.exe
c:\windows\system32\EJqride_IeJ32W-.dll
c:\windows\System32\35D5695AED.sys
Folder::
Driver::
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1db49b11-14ce-6198-ddb5-7f724fc6b5d6}]
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000000
RegLockDel:: Save the above as CFScript.txt drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.http://users.pandora.be/bluepatchy/m...s/CFScript.gif Combofix.txt A new HijackThis log .
#5
Member
Profile: Join Date: Apr 2010
Location: Lincoln, UK
Posts: 8
Computer Experience:
Thanks you againhttp .sysjs : browser.startup.homepage - hxxp://www3.iamwired.net/js : keyword.URL - hxxp://www3.iamwired.net/websearch.php?src=tops&search=js : keyword.enabled - truejs : browser.search.defaulturl - hxxp://www3.iamwired.net/websearch.php?src=tops&search=SP1 (WinNT 6.00.1905)http://www.google.co.uk/ http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://www.intercasino.co.uk/ (file missing) (HKCU)http://www.intercasino.co.uk/ (file missing) (HKCU)http://upload.facebook.com/controls/...oUploader5.cab https://support.dell.com/systemprofiler/SysProExe.CAB http://gfx1.hotmail.com/mail/w3/pr01...PUplden-gb.cab http://upload.facebook.com/controls/...Uploader55.cab http://gfx1.hotmail.com/mail/w4/pr01...PUplden-gb.cab https://plugins.valueactive.eu/flashax/iefax.cab
#6
Malware Analyst
Profile: Join Date: Aug 2002
Location: Daly City, CA
Posts: 10,012
Computer Experience:
Looking good Combofix :Start > Run [Vista users, go Start>"Start search"]Combofix /Uninstall Note the space between the "Combofix" and the "/Uninstall" Print these instructions out. NOTE. If any of the programs listed below refuse to run, try renaming executive file to something else; for instance, rename hijackthis.exe scanner.exe ***VERY IMPORTANT! Make sure, you update Malwarebytes before running the scans.***STEP 1. Malwarebytes' Anti-Malware : http://www.malwarebytes.org/mbam.php to your desktop.(Malwarebytes is free to use as a manual scanner. Payment is only required if you wish to have it run and update automatically which is not necessary for our purposes) mbam-setup.exe and follow the prompts to install the program.Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware , then click Finish .Perform Quick Scan , then click Scan .Show Results to view the results.Remove Selected .Post the log back here .log-date.txt log-date.txt RESTART COMPUTER! STEP 2. Post fresh HijackThis log. NOTE. If you're using Vista, right click on HijackThis , and click Run as Administrator DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
#7
Member
Profile: Join Date: Apr 2010
Location: Lincoln, UK
Posts: 8
Computer Experience:
Okay heres the next to logs:www.malwarebytes.org SP1 (WinNT 6.00.1905)http://www.google.co.uk/ http://www.google.co.uk/ig/dell?hl=e...uk&ibd=2080712 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://www.intercasino.co.uk/ (file missing) (HKCU)http://www.intercasino.co.uk/ (file missing) (HKCU)http://upload.facebook.com/controls/...oUploader5.cab https://support.dell.com/systemprofiler/SysProExe.CAB http://gfx1.hotmail.com/mail/w3/pr01...PUplden-gb.cab http://upload.facebook.com/controls/...Uploader55.cab http://gfx1.hotmail.com/mail/w4/pr01...PUplden-gb.cab https://plugins.valueactive.eu/flashax/iefax.cab
#8
Malware Analyst
Profile: Join Date: Aug 2002
Location: Daly City, CA
Posts: 10,012
Computer Experience:
I apologize for the delay. Email notification missed me somehow.Dr.Web CureIt to the desktop:ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe http://majorgeeks.com/Dr.Web_CureIT_d4783.html Doubleclick the drweb-cureit.exe file and click Scan to run express scan. Click OK in pop-up window to allow scan.
This will scan the files currently running in memory and when something is found, click the Yes button when it asks you if you want to cure it. This is only a short scan.
Once the short scan has finished, select Complete scan .
Click the green arrow http://i154.photobucket.com/albums/s...sy69/drweb.jpg at the right, and the scan will start.
Click Yes to all if it asks if you want to cure/move the file.
When the scan has finished, in the menu, click File and choose Save report list
Save the report to your desktop . The report will be called DrWeb.csv
Close Dr.Web Cureit.
Important! Copy and paste that log in the next reply. You can use Notepad to open the DrWeb.cvs report.NOTE . During the scan, pop-up window will open asking for full version purchase. Simply close the window by clicking on X in upper right corner.
#9
Member
Profile: Join Date: Apr 2010
Location: Lincoln, UK
Posts: 8
Computer Experience:
Thanks for the help.SP1 (WinNT 6.00.1905)http://www.google.co.uk/ http://www.google.co.uk/ig/dell?hl=e...uk&ibd=2080712 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://www.intercasino.co.uk/ (file missing) (HKCU)http://www.intercasino.co.uk/ (file missing) (HKCU)http://upload.facebook.com/controls/...oUploader5.cab https://support.dell.com/systemprofiler/SysProExe.CAB http://gfx1.hotmail.com/mail/w3/pr01...PUplden-gb.cab http://upload.facebook.com/controls/...Uploader55.cab http://gfx1.hotmail.com/mail/w4/pr01...PUplden-gb.cab https://plugins.valueactive.eu/flashax/iefax.cab
#10
Malware Analyst
Profile: Join Date: Aug 2002
Location: Daly City, CA
Posts: 10,012
Computer Experience:
1. Download Temp File Cleaner (TFC) TFC.exe to run the program.Start button to begin cleaning process.may ask you to restart computer.Kaspersky website and perform an online antivirus scan.Accept button.Run .Settings .Spyware, Adware, Dialers, and other potentially dangerous programs Archives
Mail databases
My Computer under Scan .View Scan Report .Save Report As.... Files of type to Text file (.txt) before clicking on the Save button. Then post it here.
#11
Member
Profile: Join Date: Apr 2010
Location: Lincoln, UK
Posts: 8
Computer Experience:
--------------------------------------------------------------------------------SP1 (WinNT 6.00.1905)http://www.google.co.uk/ http://www.google.co.uk/ig/dell?hl=e...uk&ibd=2080712 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://www.intercasino.co.uk/ (file missing) (HKCU)http://www.intercasino.co.uk/ (file missing) (HKCU)http://upload.facebook.com/controls/...oUploader5.cab https://support.dell.com/systemprofiler/SysProExe.CAB http://gfx1.hotmail.com/mail/w3/pr01...PUplden-gb.cab http://upload.facebook.com/controls/...Uploader55.cab http://gfx1.hotmail.com/mail/w4/pr01...PUplden-gb.cab https://plugins.valueactive.eu/flashax/iefax.cab
#12
Malware Analyst
Profile: Join Date: Aug 2002
Location: Daly City, CA
Posts: 10,012
Computer Experience:
Please download JavaRa Run JavaRa.exe (Vista users! Right click on JavaRa.exe , click Run As Administrator ), pick the language of your choice and click Select. Then click Remove Older Versions .
Accept any prompts.
Open JavaRa.exe again and select Search For Updates .
Select Update Using Sun Java's Website then click Search and click on the Open Webpage button. Download and install the latest Java Runtime Environment (JRE) version for your computer.
Note 1 : UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.Note 2 : The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. If you don't want to run another extra service, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and restart your computer.Windows Defender by clicking the Start , clicking All Programs , and then clicking Windows Defender .Tools Windows XP General Settings Real Time Protection Options Turn on Real Time Protection Save buttonWindows Defender Windows Vista Options Administrator options , clear the Use Windows Defender check box, and then click Save .Print this post out, since you won't have an access to it, at some point. O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (file missing) O4 - HKLM\..\Run: [ECenter] C:\Dell\E-Center\EULALauncher.exe Fix checked button.
#13
Member
Profile: Join Date: Apr 2010
Location: Lincoln, UK
Posts: 8
Computer Experience:
Ok, that's done and this is the next log:SP1 (WinNT 6.00.1905)http://www.google.co.uk/ http://www.google.co.uk/ig/dell?hl=e...uk&ibd=2080712 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://www.intercasino.co.uk/ (file missing) (HKCU)http://www.intercasino.co.uk/ (file missing) (HKCU)http://upload.facebook.com/controls/...oUploader5.cab https://support.dell.com/systemprofiler/SysProExe.CAB http://gfx1.hotmail.com/mail/w3/pr01...PUplden-gb.cab http://upload.facebook.com/controls/...Uploader55.cab http://gfx1.hotmail.com/mail/w4/pr01...PUplden-gb.cab https://plugins.valueactive.eu/flashax/iefax.cab
#14
Malware Analyst
Profile: Join Date: Aug 2002
Location: Daly City, CA
Posts: 10,012
Computer Experience:
It doesn't look like anything was "fixed".HJT log free of any garbage.http://www.avast.com/eng/download-avast-home.html http://www.free-av.com/en/download/1...antivirus.html
#15
Member
Profile: Join Date: Apr 2010
Location: Lincoln, UK
Posts: 8
Computer Experience:
I didn't turn it off properly, so I did it again made sure Windows defender was turned off, only had HijackThis open on its own and the results were the same apart from one entry which is no longer showing:
All times are GMT +1. The time now is 04:23 .
